flowviant 0.54.2 → 0.55.0

package/bin/cli.mjs

@@ -32,6 +32,13 @@
  * odd side job the roster carries — a commit's patch, a preview share, a wiki
  * regen. When you say ship, the daemon merges that branch into base `--no-ff`.
  *
+ * MANY PROJECTS, ONE BOX (0.55.0): `flowviant login` in each repo stores one
+ * credential per project (~/.flowviant/credentials.json holds a map), and a
+ * bare `npx flowviant` serves the project BOUND to the repo it is started in.
+ * Ambiguity is a picker on a TTY and a worded refusal headless — never a
+ * guess. `flowviant projects` lists what is stored; `--project <name|id>`
+ * picks without a prompt.
+ *
  * Env:
  *   FLOWVIANT_FLEET     the machine credential (or use `flowviant login`).
  *   FLOWVIANT_API_URL   default https://api.flowviant.com/api/v2
@@ -49,7 +56,7 @@
  * git + worktreeDiff + patch; localSessions, listeners, preview + authproxy;
  * env + env-cli + vault, resources, deploy, shot.
  */
-import { FLEET_TOKEN } from './lib/config.mjs';
+import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './lib/config.mjs';
 import { runFleetDaemon } from './lib/fleet.mjs';
 import { runLogin } from './lib/login.mjs';
 
@@ -172,6 +179,32 @@ if (process.argv[2] === 'stop') {
   process.exit(failed > 0 ? 1 : 0);
 }
 
+// `flowviant projects` — every project this box has a credential for, which
+// repo each is bound to, and which the legacy mirror points at. Needs no
+// network: it reads the store, which is the exact thing a confused person is
+// trying to see. The remedies are named because this listing IS the moment of
+// confusion ("why did it say skadooble?"), not documentation.
+if (process.argv[2] === 'projects') {
+  const { listStoredProjects, projectLabel } = await import('./lib/credentials.mjs');
+  const entries = listStoredProjects();
+  if (entries.length === 0) {
+    console.log('no projects connected on this machine yet — run `flowviant login` inside a repo.');
+    process.exit(0);
+  }
+  for (const e of entries) {
+    console.log(
+      `  ${projectLabel(e)}  (${e.projectId.slice(0, 8)}…)` +
+        `${e.repoRoot ? `\n      repo · ${e.repoRoot}` : '\n      repo · not bound yet — first start or login in its repo binds it'}` +
+        `${e.active ? '\n      what a pre-0.55.0 flowviant on this box would serve (the legacy mirror)' : ''}`
+    );
+  }
+  console.log(
+    '\n  `npx flowviant` picks by the repo it is started in; `--project <name|id>` overrides;\n' +
+      '  `flowviant login` in a new repo connects another project.'
+  );
+  process.exit(0);
+}
+
 // `flowviant env <import|set|show>` — the CLI half of team env sync. Values
 // are sealed to the project pubkey ON THIS MACHINE (same write-only crypto as
 // the browser); `show` decrypts locally — it only works on an ENROLLED machine.
@@ -191,14 +224,117 @@ if (process.argv[2] === 'env') {
   process.exit(0);
 }
 
+// ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
+//
+// The store holds many projects since 0.55.0 and resolution is BY REPO
+// (credentials.mjs). What is left here is the human half: an ambiguous store
+// on a TTY becomes a PICKER, a single unbound credential gets ONE confirm that
+// binds it, and a headless start with no unambiguous answer refuses in words
+// that name every stored project and every way out. The one thing this block
+// must never do is serve a project the resolution did not name — "it said
+// skadooble in my calendar repo" is the confusion this exists to end.
+const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+const externalToken = process.argv.includes('--fleet') || Boolean(process.env.FLOWVIANT_FLEET);
+
+/** Re-exec a plain `flowviant` after an inline login — the login command's own
+ *  pattern: config.mjs read the store at IMPORT time, before the credential
+ *  existed, so this process cannot serve; the child can. */
+async function reexecAfterLogin() {
+  await runLogin({ thenStart: false });
+  const { spawn } = await import('node:child_process');
+  const child = spawn(process.execPath, [process.argv[1]], { stdio: 'inherit', env: process.env });
+  process.exit(await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0))));
+}
+
+function listLines(entries, { projectLabel }) {
+  return entries
+    .map(
+      (e, i) =>
+        `  ${i + 1}. ${projectLabel(e)}` +
+        (e.repoRoot ? `  — connected for ${e.repoRoot}` : '  — not tied to a repo yet')
+    )
+    .join('\n');
+}
+
 if (!FLEET_TOKEN) {
-  console.error(
-    'error: no credential found. Easiest:\n' +
-      '  flowviant login      (approve in the app — recommended)\n' +
-      'Or set:\n' +
-      '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
-  );
-  process.exit(1);
+  if (CREDENTIAL.error) {
+    console.error(`error: ${CREDENTIAL.error}. \`flowviant projects\` lists what is stored.`);
+    process.exit(1);
+  }
+  if (CREDENTIAL.choices?.length && interactive) {
+    const creds = await import('./lib/credentials.mjs');
+    const { choices, repoRoot } = CREDENTIAL;
+    console.log(
+      CREDENTIAL.reason === 'outside-repo'
+        ? 'flowviant is not inside a git repo, and more than one project is connected here.'
+        : CREDENTIAL.reason === 'multiple-bound'
+          ? `More than one connected project names this repo (${repoRoot}) — pick which one this daemon serves:`
+          : `This repo (${repoRoot}) is not connected to any project yet. Connected on this machine:`
+    );
+    console.log(listLines(choices, creds));
+    console.log(`  ${choices.length + 1}. connect ${repoRoot ? 'this repo' : 'a repo'} to a different project (flowviant login)`);
+    const rl = (await import('node:readline/promises')).createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    const raw = (await rl.question(`Which project should this daemon serve? [1-${choices.length + 1}] `)).trim();
+    rl.close();
+    const n = Number.parseInt(raw, 10);
+    if (n === choices.length + 1) await reexecAfterLogin();
+    const picked = Number.isInteger(n) ? choices[n - 1] : undefined;
+    if (!picked) {
+      console.error('nothing chosen — nothing started.');
+      process.exit(1);
+    }
+    // An answered question is consent: adopt it, and BIND it to this repo so
+    // the next start needs no prompt. Repointing is legitimate and said aloud.
+    if (repoRoot && picked.repoRoot && picked.repoRoot !== repoRoot) {
+      console.log(`note: ${creds.projectLabel(picked)} was connected for ${picked.repoRoot} — now serving ${repoRoot} instead.`);
+    }
+    adoptStoredCredential(picked);
+    creds.selectStoredProject(picked.projectId, { bindRepoRoot: repoRoot ?? undefined });
+    console.log(`serving ${creds.projectLabel(picked)}${repoRoot ? ` from ${repoRoot}` : ''}.`);
+  } else if (CREDENTIAL.choices?.length) {
+    const creds = await import('./lib/credentials.mjs');
+    console.error(
+      'error: more than one project is connected on this machine and this repo is not bound to any of them:\n' +
+        listLines(CREDENTIAL.choices, creds) +
+        '\nPick one with `--project <name|id>`, bind this repo by running `flowviant` here in a terminal once,\n' +
+        'or connect this repo to its own project with `flowviant login`.'
+    );
+    process.exit(1);
+  } else {
+    console.error(
+      'error: no credential found. Easiest:\n' +
+        '  flowviant login      (approve in the app — recommended)\n' +
+        'Or set:\n' +
+        '  FLOWVIANT_FLEET=fva_…   (machine token, from the app)'
+    );
+    process.exit(1);
+  }
+} else if (!externalToken && CREDENTIAL.needsConfirm && interactive) {
+  // ONE stored project, never tied to a repo — the pre-0.55.0 world. Ask once;
+  // yes binds and every later start is silent. This is the exact question
+  // whose absence had a calendar checkout serving skadooble.
+  const creds = await import('./lib/credentials.mjs');
+  const label = creds.projectLabel(CREDENTIAL.entry);
+  const rl = (await import('node:readline/promises')).createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  const raw = (
+    await rl.question(`This machine's one connected project is ${label}. Serve this repo (${CREDENTIAL.repoRoot}) as ${label}? [Y/n] `)
+  ).trim().toLowerCase();
+  rl.close();
+  if (raw === '' || raw === 'y' || raw === 'yes') {
+    creds.bindStoredRepo(CREDENTIAL.entry.projectId, CREDENTIAL.repoRoot);
+  } else {
+    console.error(
+      `nothing started. Connect this repo to its own project with \`flowviant login\`, ` +
+        `or see what is stored with \`flowviant projects\`.`
+    );
+    process.exit(1);
+  }
 }
 
 await runFleetDaemon();

package/bin/lib/config.mjs

@@ -4,7 +4,7 @@ import { randomBytes } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir, cpus, totalmem } from 'node:os';
+import { cpus, totalmem } from 'node:os';
 
 // Read the daemon's version from its OWN package.json (always shipped in the npm
 // tarball) — never hardcode it. The hardcoded constant drifted: it sat at
@@ -30,14 +30,11 @@ export const MODEL = process.env.FLOWVIANT_MODEL || 'opus';
 
 // Credential stored by `flowviant login` (device auth) — the no-token,
 // no-env-var path. An explicit --fleet flag or FLOWVIANT_FLEET env still wins.
-function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(join(homedir(), '.flowviant', 'credentials.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-}
-const stored = readStoredCredential();
+// Since 0.55.0 the store holds MANY projects and resolution is BY REPO — see
+// credentials.mjs for the whole rule. `CREDENTIAL` carries the resolution so
+// cli.mjs can turn an ambiguity into a picker instead of a guess.
+import { resolveStoredCredential } from './credentials.mjs';
+export const CREDENTIAL = resolveStoredCredential();
 
 function argFlag(name) {
   const i = process.argv.indexOf(name);
@@ -167,5 +164,15 @@ export const DAEMON_INSTANCE = randomBytes(12).toString('hex');
 // --tokens) stood beside it and carried WORKER tokens into the pre-daemon loop;
 // that principal owns zero tools since dispatch was deleted, and the kind can no
 // longer be minted, so the plumbing went with the entrypoint (2026-08-19).
-export const FLEET_TOKEN =
-  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || stored?.fleetToken || '';
+// `let`, because ES named imports are LIVE bindings: when cli.mjs answers an
+// ambiguous store with a picker, adoptStoredCredential updates every importer
+// before the daemon touches the network. Everything before that point (the
+// resolution, the flags) is settled synchronously at import, as it always was.
+export let FLEET_TOKEN =
+  argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
+
+/** cli.mjs's picker chose. Must run BEFORE runFleetDaemon — nothing here
+ *  re-authenticates a connection already made. */
+export function adoptStoredCredential(entry) {
+  if (entry?.fleetToken) FLEET_TOKEN = entry.fleetToken;
+}

package/bin/lib/credentials.mjs

@@ -0,0 +1,258 @@
+/**
+ * THE CREDENTIAL STORE — one file, MANY projects (v2, 2026-08-23).
+ *
+ * ~/.flowviant/credentials.json used to hold exactly one credential, and
+ * `flowviant login` overwrote it — so `npx flowviant` in ANY directory served
+ * whatever project was logged into last. A user standing in their calendar
+ * repo watched the banner say another project's name, and the only thing that
+ * saved them from serving the wrong repo was the instance lock's same-repo
+ * refusal. One VM is allowed to run one daemon per project (the lock is keyed
+ * per credential and the header of instance.mjs says so out loud); the store
+ * was the only thing pretending otherwise.
+ *
+ * THE FILE SHAPE, and why it is two shapes at once:
+ *
+ *   {
+ *     fleetToken, projectId, mcpUrl,          // the LEGACY MIRROR
+ *     projects: {                             // v2: every connected project
+ *       [projectId]: { fleetToken, mcpUrl, name, repoRoot, savedAt }
+ *     }
+ *   }
+ *
+ * The top-level trio is what every daemon before 0.55.0 reads, and the CLI is
+ * the one component a deploy cannot upgrade — so it stays, always mirroring
+ * the ACTIVE (most recently logged-in or explicitly picked) project. An old
+ * version keeps working with that project; a new one resolves by REPO.
+ *
+ * WHICH CREDENTIAL A START USES — resolution, in order:
+ *   --fleet / FLOWVIANT_FLEET     the operator said, verbatim (config.mjs).
+ *   --project <name|id>           an entry, named without a prompt.
+ *   the entry BOUND to this repo  repoRoot recorded at login/confirm, compared
+ *                                 by realpath — the no-ambiguity path.
+ *   one unbound entry             served, with a one-time TTY confirm that
+ *                                 binds it (headless keeps the old behaviour —
+ *                                 a systemd restart must not hang on a prompt).
+ *   anything else                 a CHOICE, never a guess: the CLI lists every
+ *                                 stored project and asks (cli.mjs), or — with
+ *                                 no TTY — refuses in words that name them all.
+ *
+ * The repoRoot binding is a SAFETY line, not bookkeeping: serving project X
+ * from a repo that is not X's checkout materializes X's session worktrees and
+ * decrypted env inside the wrong repository. Binding happens only at moments a
+ * HUMAN was present (login, an answered confirm, an explicit pick) — never
+ * silently on a headless start, where cementing the wrong repo would make the
+ * mistake permanent.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const CRED_DIR = join(homedir(), '.flowviant');
+const CRED_FILE = join(CRED_DIR, 'credentials.json');
+
+function readFile() {
+  try {
+    const v = JSON.parse(readFileSync(CRED_FILE, 'utf8'));
+    return v && typeof v === 'object' ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Atomic write (tmp + rename), 0600 — this file is credentials. */
+function writeFile(v) {
+  mkdirSync(CRED_DIR, { recursive: true });
+  const tmp = `${CRED_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(v, null, 2), { mode: 0o600 });
+  renameSync(tmp, CRED_FILE);
+}
+
+/** The repo root of `cwd`, realpath'd, or null when not inside a git repo. */
+export function detectRepoRoot(cwd = process.cwd()) {
+  try {
+    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+    }).trim();
+    return root ? realpathSync(root) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Same directory whatever it is spelled as — the instance.mjs rule. */
+function samePath(a, b) {
+  if (!a || !b) return false;
+  const norm = (v) => {
+    try {
+      return realpathSync(v);
+    } catch {
+      return String(v).replace(/\/+$/, '');
+    }
+  };
+  return norm(a) === norm(b);
+}
+
+/**
+ * Every stored project, NORMALIZED: the v2 map, plus the legacy trio surfaced
+ * as an entry when no map row carries its token (a pre-0.55.0 file is one
+ * project with no name and no binding — real, and listed as such). `active`
+ * marks the entry the legacy mirror points at.
+ */
+export function listStoredProjects() {
+  const f = readFile();
+  if (!f) return [];
+  const out = new Map();
+  for (const [projectId, e] of Object.entries(f.projects ?? {})) {
+    if (!e || typeof e.fleetToken !== 'string' || !e.fleetToken) continue;
+    out.set(projectId, {
+      projectId,
+      fleetToken: e.fleetToken,
+      mcpUrl: e.mcpUrl ?? null,
+      name: typeof e.name === 'string' && e.name ? e.name : null,
+      repoRoot: typeof e.repoRoot === 'string' && e.repoRoot ? e.repoRoot : null,
+      savedAt: e.savedAt ?? null,
+    });
+  }
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !out.has(f.projectId)) {
+    out.set(f.projectId, {
+      projectId: f.projectId,
+      fleetToken: f.fleetToken,
+      mcpUrl: f.mcpUrl ?? null,
+      name: null,
+      repoRoot: null,
+      savedAt: null,
+    });
+  }
+  return [...out.values()].map((e) => ({ ...e, active: e.projectId === f.projectId }));
+}
+
+/** What a project is CALLED on a terminal: its name, or an id you can grep. */
+export function projectLabel(e) {
+  return e?.name ?? (e?.projectId ? `project ${e.projectId.slice(0, 8)}…` : 'an unnamed project');
+}
+
+function mutate(fn) {
+  const f = readFile() ?? {};
+  if (!f.projects || typeof f.projects !== 'object') f.projects = {};
+  // Surface a legacy trio into the map before any edit, so nothing loses it.
+  if (typeof f.fleetToken === 'string' && f.fleetToken && typeof f.projectId === 'string' && f.projectId && !f.projects[f.projectId]) {
+    f.projects[f.projectId] = { fleetToken: f.fleetToken, mcpUrl: f.mcpUrl ?? null };
+  }
+  fn(f);
+  writeFile(f);
+  return f;
+}
+
+/** A fresh login: upsert the entry AND point the legacy mirror at it. */
+export function saveLogin({ fleetToken, projectId, mcpUrl, name, repoRoot }) {
+  mutate((f) => {
+    f.projects[projectId] = {
+      ...(f.projects[projectId] ?? {}),
+      fleetToken,
+      mcpUrl: mcpUrl ?? null,
+      ...(name ? { name } : {}),
+      ...(repoRoot ? { repoRoot } : {}),
+      savedAt: new Date().toISOString(),
+    };
+    f.fleetToken = fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = mcpUrl ?? null;
+  });
+}
+
+/** An explicit human pick: repoint the legacy mirror, and — when the pick was
+ *  made standing in a repo — bind the entry there. A pick IS the confirmation;
+ *  binding on anything less would cement a guess. */
+export function selectStoredProject(projectId, { bindRepoRoot } = {}) {
+  mutate((f) => {
+    const e = f.projects[projectId];
+    if (!e) return;
+    if (bindRepoRoot) e.repoRoot = bindRepoRoot;
+    f.fleetToken = e.fleetToken;
+    f.projectId = projectId;
+    f.mcpUrl = e.mcpUrl ?? null;
+  });
+}
+
+export function bindStoredRepo(projectId, repoRoot) {
+  if (!repoRoot) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].repoRoot = repoRoot;
+  });
+}
+
+/** The roster names the project on every poll; remember it so the picker and
+ *  `flowviant projects` can say a NAME instead of an id. */
+export function setStoredProjectName(projectId, name) {
+  if (!projectId || typeof name !== 'string' || !name) return;
+  const entries = listStoredProjects();
+  const e = entries.find((x) => x.projectId === projectId);
+  if (!e || e.name === name) return;
+  mutate((f) => {
+    if (f.projects[projectId]) f.projects[projectId].name = name;
+  });
+}
+
+/** Match `--project <ref>` against the store: exact id, id prefix (≥6), or
+ *  case-insensitive name. Ambiguity is an error, never a coin flip. */
+export function matchStoredProject(ref) {
+  const entries = listStoredProjects();
+  const q = String(ref ?? '').trim();
+  if (!q) return { error: 'empty --project value' };
+  const byId = entries.filter(
+    (e) => e.projectId === q || (q.length >= 6 && e.projectId.startsWith(q))
+  );
+  const byName = entries.filter((e) => e.name && e.name.toLowerCase() === q.toLowerCase());
+  const hits = byId.length > 0 ? byId : byName;
+  if (hits.length === 1) return { entry: hits[0] };
+  if (hits.length > 1) return { error: `"${q}" matches ${hits.length} stored projects — use the full project id` };
+  return { error: `no stored project matches "${q}"` };
+}
+
+/**
+ * Resolve which stored credential this invocation should use. PURE over the
+ * store + argv + cwd; every refusal and prompt above it is built from what
+ * this returns. Shapes:
+ *   { entry, source: 'project-flag' | 'repo' | 'only', needsConfirm? }
+ *   { choices, reason: 'no-match' | 'multiple-bound' | 'outside-repo', repoRoot }
+ *   { none: true }
+ *   { error }
+ *
+ * Deliberately NO mirror fallback once more than one project is stored: the
+ * mirror is whichever login happened last, and serving it because it was
+ * recent is exactly the calendar-says-skadooble surprise this file exists to
+ * end. Two projects means the answer is a QUESTION (or --project, or the
+ * repo binding), never recency.
+ */
+export function resolveStoredCredential(argv = process.argv, cwd = process.cwd()) {
+  const i = argv.indexOf('--project');
+  const projectArg = i >= 0 ? argv[i + 1] : undefined;
+  if (projectArg !== undefined) {
+    const m = matchStoredProject(projectArg);
+    return m.entry ? { entry: m.entry, source: 'project-flag' } : { error: m.error };
+  }
+  const entries = listStoredProjects();
+  if (entries.length === 0) return { none: true };
+  const repoRoot = detectRepoRoot(cwd);
+
+  if (repoRoot) {
+    const bound = entries.filter((e) => samePath(e.repoRoot, repoRoot));
+    if (bound.length === 1) return { entry: bound[0], source: 'repo', repoRoot };
+    if (bound.length > 1) return { choices: bound, reason: 'multiple-bound', repoRoot };
+  }
+
+  // ONE stored project with no binding: the pre-0.55.0 world. Serve it — a
+  // headless restart must not hang — but flag it, so a TTY start asks ONCE and
+  // binds, which is what turns "it said skadooble in my calendar repo" into a
+  // question instead of a surprise.
+  if (entries.length === 1 && !entries[0].repoRoot) {
+    return { entry: entries[0], source: 'only', needsConfirm: Boolean(repoRoot), repoRoot };
+  }
+
+  return { choices: entries, reason: repoRoot ? 'no-match' : 'outside-repo', repoRoot };
+}

package/bin/lib/env-cli.mjs

@@ -105,7 +105,11 @@ async function readSecretFromStdin(promptText) {
 }
 
 export async function runEnvCommand(args) {
-  if (!FLEET_TOKEN) die('no fleet credential — run `flowviant login` first.');
+  if (!FLEET_TOKEN)
+    die(
+      'no credential resolves here — run `flowviant login`, or run this inside the ' +
+        "project's own repo / pass `--project <name|id>` (`flowviant projects` lists them)."
+    );
   await sodium.ready;
   await ensureKeypair();
   const cmd = args[0];

package/bin/lib/fleet.mjs

@@ -31,7 +31,9 @@ import {
   REFRESH_BEFORE_SECONDS,
   LIVE,
   AUTO_UPDATE,
+  CREDENTIAL,
 } from './config.mjs';
+import { projectLabel, setStoredProjectName } from './credentials.mjs';
 import { handleVersionSignal } from './update.mjs';
 import {
   git,
@@ -322,6 +324,14 @@ export async function runFleetDaemon() {
   const repoRoot = repoRootOrDie();
   const baseRef = detectBaseRef(repoRoot);
   info(SAFE ? 'mode   · safe (restricted toolset)' : 'mode   · unattended (skips permission prompts)');
+  // WHICH PROJECT, before anything connects — the roster names it again a few
+  // seconds later with the server's word, but "which project is this daemon
+  // about to serve" must not require a network round trip to answer. Only when
+  // the credential came from the STORE: a --fleet/env token names no project
+  // until the roster does.
+  if (CREDENTIAL?.entry) {
+    info(`serves · ${projectLabel(CREDENTIAL.entry)} ${c.dim(`(${CREDENTIAL.entry.projectId.slice(0, 8)}…)`)}`);
+  }
   info(`repo   · ${repoRoot}`);
   info(`base   · ${baseRef}`);
   info(`server · ${FLEET_URL}`);
@@ -1305,6 +1315,11 @@ export async function runFleetDaemon() {
           `${c.cyan('project')} · ${c.bold(roster.project.name)} ${c.dim(`(${roster.project.id})`)}`
         );
         note(c.dim('  wiki + agents stream to THIS project — view its Code canvas in Flowviant.'));
+        // Remember the NAME beside the stored credential, so the picker and
+        // `flowviant projects` can say "skadooble" instead of an id — a
+        // credential saved before the server sent names backfills here. No-op
+        // for a --fleet/env token (nothing stored to annotate).
+        setStoredProjectName(roster.project.id, roster.project.name);
       }
     }
     if (roster.mcpUrl) mcpUrl = roster.mcpUrl;

package/bin/lib/login.mjs

@@ -6,33 +6,15 @@
  * plain `flowviant` just runs — no token, no env var.
  */
 
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
+import { saveLogin, detectRepoRoot, projectLabel } from './credentials.mjs';
 import { c, info, ok, warn, fail } from './ui.mjs';
 import { sleep } from './claude.mjs';
 
-const CRED_DIR = join(homedir(), '.flowviant');
-const CRED_FILE = join(CRED_DIR, 'credentials.json');
 const DEVICE_START = FLEET_URL.replace(/\/agents\/?$/, '/device/start');
 const DEVICE_POLL = FLEET_URL.replace(/\/agents\/?$/, '/device/poll');
 const APP_URL = process.env.FLOWVIANT_APP_URL || 'https://app.flowviant.com';
 
-/** The locally-stored credential from a prior `login`, or null. Read by config. */
-export function readStoredCredential() {
-  try {
-    return JSON.parse(readFileSync(CRED_FILE, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function store(cred) {
-  mkdirSync(CRED_DIR, { recursive: true });
-  writeFileSync(CRED_FILE, JSON.stringify(cred, null, 2), { mode: 0o600 });
-}
-
 async function post(url, body) {
   const res = await fetch(url, {
     method: 'POST',
@@ -76,10 +58,26 @@ export async function runLogin({ thenStart = false } = {}) {
     if (poll.status === 'approved') {
       // `machineToken` is the wire's new name; `fleetToken` is the one every
       // published daemon reads. The server dual-sends until DAEMON_MIN clears
-      // THIS release (0.54.2) — reading both here is what makes retiring the
-      // old key possible at all.
-      store({ fleetToken: poll.machineToken ?? poll.fleetToken, projectId: poll.projectId, mcpUrl: poll.mcpUrl });
-      ok('connected — credential saved to ~/.flowviant/credentials.json');
+      // the release that reads the new one (0.54.2+) — reading both here is
+      // what makes retiring the old key possible at all.
+      //
+      // BOUND to the repo the login was run in: a login is the one moment we
+      // know for certain which checkout this project means, and the binding is
+      // what lets a multi-project VM resolve `npx flowviant` by DIRECTORY
+      // instead of by whichever login happened last.
+      const repoRoot = detectRepoRoot();
+      const entry = {
+        fleetToken: poll.machineToken ?? poll.fleetToken,
+        projectId: poll.projectId,
+        mcpUrl: poll.mcpUrl,
+        name: typeof poll.projectName === 'string' && poll.projectName ? poll.projectName : null,
+        repoRoot,
+      };
+      saveLogin(entry);
+      ok(
+        `connected to ${c.bold(projectLabel(entry))}` +
+          `${repoRoot ? ` for ${c.dim(repoRoot)}` : ''} — saved to ~/.flowviant/credentials.json`
+      );
       // The daemon starts right here unless the caller opted out; telling
       // someone to run a second command was the step that got missed, since by
       // this point they are looking at the browser, not this terminal.

package/bin/lib/mcp-cli.mjs

@@ -23,8 +23,9 @@ const CLI_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/cli-token');
 export async function runMcpCommand(args = []) {
   if (!FLEET_TOKEN) {
     console.error(
-      'error: no credential. Run `flowviant login` first — this needs the\n' +
-        'fleet credential the daemon uses, so it knows which project to connect.'
+      'error: no credential resolves here. Run `flowviant login` first — or, with\n' +
+        'several projects connected on this box, run this inside the project\'s own\n' +
+        'repo or pass `--project <name|id>` (`flowviant projects` lists them).'
     );
     process.exit(1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.54.2",
+  "version": "0.55.0",
   "description": "Run your own coding CLIs as build agents for Flowviant — Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {